NetFlow Security

OneFirewall cross-references this traffic against threat intelligence from its Cybersecurity Alliance to flag previously allowed traffic that has since been identified as malicious.

​

Getting Started

​

1. Account and Licensing

• An active OneFirewall account (on-prem or cloud).
• A valid license for NetFlow Security Analysis.
• Permissions to access API functionality.

​

2. Generate Your API Token

​

Sending Network Metadata

​

POST Request

import requests
import json

url = "https://app.onefirewall.com/api/v1/poc_traffic/direct"

payload = json.dumps({
  "firewall": "fortinet",
  "direction": "inbound",
  "dst_ip": "192.168.0.1",
  "service": "org1",
  "src_port": 3435,
  "dst_port": 443,
  "src_ip": "94.22.73.32",
  "action": "Allow"
})
headers = {
  'Authorization': '',
  'Content-Type': 'application/json'
}

response = requests.request("POST", url, headers=headers, data=payload)

print(response.text)

• firewall: Name of your firewall or IPS
• direction: inbound or outbound
• src_ip / dst_ip: Source and destination IPv4 addresses
• src_port / dst_port: Source and destination port numbers
• service: Human-readable name of the service
• action: Allow or Deny

​

Response Codes

• 200 OK – Request accepted
• 201 Created – Resource created and queued for analysis
• 4xx – Error in request (e.g., malformed payload or invalid token)

​

Rate Limiting

• 150 requests per 10 seconds
• Requests beyond this rate will be throttled or rejected

​

View Live Reports

1. Go to https://app.onefirewall.com
2. Navigate to the Live section
3. View real-time analysis and threat assessments

​

What NetFlow Security Analysis Provides

• Detects malicious activity that slipped past traditional security layers
• Gives visibility into blocked and allowed traffic across your perimeter
• Uses threat intelligence from the Cybersecurity Alliance
• Supports zero-trust strategies with traffic-level data